where \(G\)  is a model to generate the perturbed image \(x_p\) .We employ a 3-layer convolutional neural network as our \(G\) . Besides, we utilize dropout [1]} to provide the randomness of our model. Compared to conventional adversarial training techniques [2]}, [3]}, which usually sample the perturbed images from an i.i.d distribution \(x_{p} \sim P(\cdot |x)\) , e.g., Gaussian distribution, our method can encode the semantic of the image \(x\)  without requiring many samples to achieve convergence [4]}.
